Kimai API returns timesheet entries a user should not be authorized to view

Summary The permission viewothertimesheet performs differently for the Kimai UI and the API, thus returning unexpected data through the API. Details When setting the viewothertimesheet permission to true, on the frontend, users can only see timesheet entries for teams they are a part of. When...

The vulnerability of Adobe Experience Manager’s content and media data management system, which exists due to the lack of measures taken to protect the website structure, allows attackers to execute arbitrary JavaScript code.

The vulnerability of the Adobe Experience Manager AEM content and media data management system exists due to the lack of measures taken to protect the website structure. Exploiting this vulnerability could allow a malicious actor to execute arbitrary JavaScript code remotely...

PT-2024-2544 · Jetbrains · Jetbrains Teamcity +1

Name of the Vulnerable Software and Affected Versions: JetBrains TeamCity versions prior to 2024.03 Description: The issue is related to weaknesses in the authorization mechanism of JetBrains TeamCity, a continuous integration and deployment system. This weakness can be exploited by a remote...

The vulnerability of the Siemens Siveillance Control software for video surveillance and security systems, related to authentication mechanisms that lack sufficient protection, allows attackers to gain access to objects for which they only have read-only rights.

The vulnerability of the Siemens Siveillance Control software for video surveillance and security systems is related to deficiencies in the authentication mechanism. Exploiting this vulnerability could allow an intruder to gain access to objects for which they only have read-only permissions...

PT-2024-20485 · Cdex · Cdex

Name of the Vulnerable Software and Affected Versions: CDeX application versions through 5.7.1 Description: The issue is related to a weak password recovery mechanism in the CDeX application, which allows the retrieval of a password reset token. Recommendations: For versions through 5.7.1, update...

CDeX 安全漏洞

CDeX is a free software package from CDeX Inc. for extracting digital audio from audio CDs and converting audio formats for Microsoft Windows. A security vulnerability exists in CDeX 5.7.1 and earlier versions that stems from the presence of a weak password recovery mechanism that allows retrieva...

The vulnerability of the WDAC OLE DB driver for SQL Server on the Windows operating system allows a hacker to execute arbitrary code.

The vulnerability of the WDAC OLE DB driver for SQL Server on the Windows operating system is related to insufficient validation of input data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the USB Pratirodh software for controlling the use of removable information storage media lies in its insufficient encryption strength, allowing a hacker to obtain the user’s password.

The vulnerability of the USB Pratirodh software for controlling the use of removable information storage media is related to insufficient encryption strength. Exploiting this vulnerability can allow a perpetrator to obtain the user’s password...

The vulnerability of the Podlove Web Player plugin in the WordPress content management system, related to deficiencies in the authentication process, allows attackers to compromise the integrity and confidentiality of protected information.

The vulnerability of the Podlove Web Player plugin in the WordPress content management system is related to deficiencies in the authentication process. Exploiting this vulnerability allows a malicious actor to compromise the integrity and confidentiality of the protected information...

The vulnerability of the Skype for Consumer instant messaging program, related to insufficient input data validation, allows a hacker to execute arbitrary code.

The vulnerability of the Skype for Consumer instant messaging program is related to insufficient validation of entered data. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code remotely...

Authentication flaw

UNSUPPPORTED WHEN ASSIGNED Authentication Bypass by Primary Weakness vulnerability in XPodas Octopod allows Authentication Bypass.This issue affects Octopod: before v1. NOTE: The vendor was contacted and it was learned that the product is not supported...

TurboBoost Commands Injection Vulnerability

TurboBoost Commands is a reactive application development tool. An injection vulnerability exists in TurboBoost Commands prior to 0.1.3 and prior to 0.2.2, which stems from existing security checks that are not robust enough to prevent all code execution...

CVE-2024-1234

The Exclusive Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via data attribute in all versions up to, and including, 2.6.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor acce...

PT-2024-6652 · Adobe · Coldfusion

Name of the Vulnerable Software and Affected Versions: ColdFusion versions 2023.6, 2021.12 and earlier Description: The issue is related to weaknesses in the authentication procedure of the ColdFusion platform. This can be exploited by a remote attacker to gain unauthorized access and escalate...

The vulnerability of the microprogramming software of Schneider Electric Easergy T200 remote control devices allows a hacker to carry out cross-site scripting attacks.

The vulnerability of the microprogramming software of Schneider Electric Easergy T200 remote control devices is related to the lack of protective measures for the website structure. Exploiting this vulnerability allows a malicious actor to carry out a cross-site scripting attack remotely...

PT-2024-2188 · Vmware · Vmware Cloud Director

Name of the Vulnerable Software and Affected Versions: VMware Cloud Director affected versions not specified Description: The issue is related to a partial information disclosure, where a malicious actor can potentially gather information about organization names based on the behavior of the...

CVE-2024-1202

CVE-2024-1202 affects XPodas Octopod prior to v1. The vulnerability is described as Authentication Bypass by Primary Weakness, enabling unauthorized access. Affected software: XPodas Octopod (before v1); root cause details are not provided in the documents beyond the bypass claim. Remediation sta...

CVE-2023-7103

Authentication Bypass by Primary Weakness vulnerability in ZKSoftware Biometric Security Solutions UFace 5 allows Authentication Bypass. This issue affects UFace 5: through 12022024...

edk2: Buffer overflow when processing DNS Servers option in a DHCPv6 Advertise message

A security weakness was identified in EDK2, the open-source reference implementation of the UEFI specification, revealing a buffer overflow vulnerability. This vulnerability enables an unauthorized attacker within proximity on the network to transmit a specifically crafted DHCPv6 Advertise messag...

PT-2024-2048 · Aruba · Arubaos

Name of the Vulnerable Software and Affected Versions: ArubaOS affected versions not specified Description: The issue is related to certain configurations of ArubaOS that can lead to partial disclosure of sensitive information in the IKE AUTH negotiation process. The scenarios in which disclosure...